HOWTO: Verify that custom error handling solutions do not expose padding oracle User32459769 posted UPDATE: I created a script to automate the verification process described here: http://forums.asp.net/p/1605099/4092891.aspx I've done some digging and come up with what I think is useful information for you if you have a custom error handling solution in place instead of or as well as the usual ASP